#include "stdafx.h"
#include "Process.h"
#include "EventMgr.h"
#include "EventFilter.h"
#include "util.h"

bool CEventFilter_PID::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetProcessId() == m_ProcessId) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetProcessId() != m_ProcessId) ? true : false;
	}
	else if (m_Relation == FltRel_LargerThan)
	{
		return (ev->GetProcessId() >= m_ProcessId) ? true : false;
	}
	else if (m_Relation == FltRel_SmallerThan)
	{
		return (ev->GetProcessId() <= m_ProcessId) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_ProcessName::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetProcessName() == m_Str) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetProcessName() != m_Str) ? true : false;
	}
	else if (m_Relation == FltRel_Contain)
	{
		return (StrStrIW(ev->GetProcessName(), m_Str) != NULL) ? true : false;
	}
	else if (m_Relation == FltRel_NotContain)
	{
		return (StrStrIW(ev->GetProcessName(), m_Str) == NULL) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_ProcessPath::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetProcessPath() == m_Str) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetProcessPath() != m_Str) ? true : false;
	}
	else if (m_Relation == FltRel_Contain)
	{
		return (StrStrIW(ev->GetProcessPath(), m_Str) != NULL) ? true : false;
	}
	else if (m_Relation == FltRel_NotContain)
	{
		return (StrStrIW(ev->GetProcessPath(), m_Str) == NULL) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_EventPath::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetEventPath() == m_Str) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetEventPath() != m_Str) ? true : false;
	}
	else if (m_Relation == FltRel_Contain)
	{
		return (StrStrIW(ev->GetEventPath(), m_Str) != NULL) ? true : false;
	}
	else if (m_Relation == FltRel_NotContain)
	{
		return (StrStrIW(ev->GetEventPath(), m_Str) == NULL) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_Arch::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetUniqueProcess()->m_bIs64Bit == m_bIs64Bit) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetUniqueProcess()->m_bIs64Bit != m_bIs64Bit) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_SessionId::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetUniqueProcess()->m_SessionId == m_SessionId) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetUniqueProcess()->m_SessionId != m_SessionId) ? true : false;
	}
	else if (m_Relation == FltRel_LargerThan)
	{
		return (ev->GetUniqueProcess()->m_SessionId >= m_SessionId) ? true : false;
	}
	else if (m_Relation == FltRel_SmallerThan)
	{
		return (ev->GetUniqueProcess()->m_SessionId <= m_SessionId) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_EventType::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetEventType() == m_EventType) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetEventType() != m_EventType) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}

bool CEventFilter_EventClass::DoFilter(CUniqueEvent *ev)
{
	if (m_Relation == FltRel_Is)
	{
		return (ev->GetEventClassify() == m_EventClass) ? true : false;
	}
	else if (m_Relation == FltRel_IsNot)
	{
		return (ev->GetEventClassify() != m_EventClass) ? true : false;
	}
	//Should not go here
	AfxDebugBreak();
	return false;
}